Regulatory compliance

In general, compliance means conforming to a rule, such as a specification, policy, standard or law. Regulatory compliance describes the goal that organizations aspire to achieve in their efforts to ensure that they are aware of and take steps to comply with relevant laws, policies, and regulations.[1] Due to the increasing number of regulations and need for operational transparency, organizations are increasingly adopting the use of consolidated and harmonized sets of compliance controls.[2] This approach is used to ensure that all necessary governance requirements can be met without the unnecessary duplication of effort and activity from resources.

Regulations and accrediting organizations vary among fields, with examples such as PCI-DSS and GLBA in the financial industry, FISMA for U.S. federal agencies, HACCP for the food and beverage industry, and the Joint Commission and HIPAA in healthcare. In some cases other compliance frameworks (such as COBIT) or even standards (NIST) inform on how to comply with regulations.

Some organizations keep compliance data—all data belonging or pertaining to the enterprise or included in the law, which can be used for the purpose of implementing or validating compliance—in a separate store for meeting reporting requirements. Compliance software is increasingly being implemented to help companies manage their compliance data more efficiently. This store may include calculations, data transfers, and audit trails.[3][4]

Contents

Regulatory compliance varies not only by industry but often by location. The financial, research, and pharmaceutical regulatory structures in one country, for example, may be similar but with particularly different nuances in another country. These similarities and differences are often a product "of reactions to the changing objectives and requirements in different countries, industries, and policy contexts."[5]

Australian organisations seeking to remain compliant with various regulations may turn to AS ISO 19600:2015 (which supersedes AS 3806-2006). This standard helps organisations with compliance management, placing "emphasis on the organisational elements that are required to support compliance" while also recognizing the need for continual improvement.[10][11]

In Canada, federal regulation of deposits, insurance, and superannuation is governed by two independent bodies: the OSFI through the Bank Act, and FINTRAC, mandated by the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, 2001 (PCMLTFA).[12][13] These groups protect consumers, regulate how risk is controlled and managed, and investigate illegal action such as money laundering and terrorist financing.[12][13] On a provincial level, each province maintain individuals laws and agencies. Unlike any other major federation, Canada does not have a securities regulatory authority at the federal government level. The provincial and territorial regulators work together to coordinate and harmonize regulation of the Canadian capital markets through the Canadian Securities Administrators (CSA).[14]

In India, compliance regulation takes place across three strata: Central, State, and Local regulation. India veers towards central regulation, especially of financial organizations and foreign funds.[18] Compliance regulations vary based on the industry segment in addition to the geographical mix. Most regulation comes in the following broad categories: economic regulation, regulation in the public interest, and environmental regulation.[19] India has also been characterized by poor compliance - reports suggest that only around 65% of companies are fully compliant to norms.[20]

The U.K. Corporate Governance Code (formerly the Combined Code) is issued by the Financial Reporting Council (FRC) and "sets standards of good practice in relation to board leadership and effectiveness, remuneration, accountability, and relations with shareholders."[21] All companies with a Premium Listing of equity shares in the U.K. are required under the Listing Rules to report on how they have applied the Combined Code in their annual report and accounts.[22] (The Codes are therefore most similar to the U.S.' Sarbanes–Oxley Act.)

The U.K.'s regulatory framework requires that all its publicly listed companies should provide specific content in the core financial statements that must appear in a yearly report, including balance sheet, comprehensive income statement, and statement of changes in equity, as well as cash flow statement as required under international accounting standards.[23] It further demonstrates the relationship that subsists among shareholders, management, and the independent audit teams. Financial statements must be prepared using a particular set of rules and regulations hence the rationale behind allowing the companies to apply the provisions of company law, international financial reporting standards (IFRS), as well as the U.K. stock exchange rules as directed by the FCA.[24] It is also possible that shareholders may not understand the figures as presented in the various financial statements, hence it is critical that the board should provide notes on accounting policies as well as other explanatory notes to help them understand the report better.

Data retention is a part of regulatory compliance that is proving to be a challenge in many instances. The security that comes from compliance with industry regulations can seem contrary to maintaining user privacy. Data retention laws and regulations ask data owners and other service providers to retain extensive records of user activity beyond the time necessary for normal business operations. These requirements have been called into question by privacy rights advocates.[25]

Compliance in this area is becoming very difficult. Laws like the CAN-SPAM Act and Fair Credit Reporting Act in the U.S. require that businesses give people the “right to be forgotten.”[26][27] In other words, they must remove individuals from marketing lists if it is requested, tell them when and why they might share personal information with a third party, or at least ask permission before sharing that data. Now, with new laws coming out that demand longer data retention despite the individual’s desires, it can create some real difficulties.

The Office of Foreign Assets Control (OFAC) is an agency of the United States Department of the Treasury under the auspices of the Under Secretary of the Treasury for Terrorism and Financial Intelligence. OFAC administers and enforces economic and trade sanctions based on U.S. foreign policy and national security goals against targeted foreign states, organizations, and individuals.

Compliance in the U.S. generally means compliance with laws and regulations. These laws can have criminal or civil penalties or can be regulations. The definition of what constitutes an effective compliance plan has been elusive. Most authors, however, continue to cite the guidance provided by the United States Sentencing Commission in Chapter 8 of the Federal Sentencing Guidelines.[29][30]

On October 12, 2006, the U.S. Small Business Administration re-launched Business.gov (new Business.USA.gov)[31] which provides a single point of access to government services and information that help businesses comply with government regulations.

The U.S. Department of Labor, Occupational Health and Safety Administration (OSHA) was created by Congress to assure safe and healthful working conditions for working men and women by setting and enforcing standards and by providing training, outreach, education and assistance. OSHA implements laws and regulations regularly in the following areas, construction, maritime, agriculture, and recordkeeping.[32]

The International Organization for Standardization (ISO) and its ISO 19600 standard is one of the primary international standards for how businesses handle regulatory compliance, providing a reminder of how compliance and risk should operate together, as “colleagues” sharing a common framework with some nuances to account for their differences.[33] The ISO also produces international standards such as ISO/IEC 27002 to help organizations meet regulatory compliance with their security management and assurance best practices.[34]

Some local or international specialized organizations such as the American Society of Mechanical Engineers (ASME) also develop standards and regulation codes. They thereby provide a wide range of rules and directives to ensure compliance of the products to safety, security or design standards.[35]